Bug fixes in gootloader, updating results

CybercentreCanada · Jan 19, 2024 · 7330c1c · 7330c1c
1 parent af2261f
commit 7330c1c
Show file tree

Hide file tree

Showing 8 changed files with 106 additions and 66 deletions.
diff --git a/tests/results/123bda1a6cedf72acd51a01f40ed32ea1e61d610ff46a05a6a7166c0777f6a8c/result.json b/tests/results/123bda1a6cedf72acd51a01f40ed32ea1e61d610ff46a05a6a7166c0777f6a8c/result.json
@@ -103,10 +103,6 @@
             "ioc": "permissions.default.camera",
             "ioc_type": "domain"
           },
-          {
-            "ioc": "toolkit.telemetry.pioneer",
-            "ioc_type": "domain"
-          },
           {
             "ioc": "http://centarial.com/documento.php",
             "ioc_type": "uri"
@@ -144,8 +140,7 @@
               "domain": [
                 "centarial.com",
                 "google.com",
-                "permissions.default.camera",
-                "toolkit.telemetry.pioneer"
+                "permissions.default.camera"
               ],
               "uri": [
                 "http://centarial.com/documento.php",
@@ -306,11 +301,6 @@
           "heur_id": 2,
           "signatures": [],
           "value": "permissions.default.camera"
-        },
-        {
-          "heur_id": 2,
-          "signatures": [],
-          "value": "toolkit.telemetry.pioneer"
         }
       ],
       "network.static.uri": [

diff --git a/tests/results/2b26cd43aee8e79e808add3cebaa4902731b529274ef697c5ff9486c71a91b4d/result.json b/tests/results/2b26cd43aee8e79e808add3cebaa4902731b529274ef697c5ff9486c71a91b4d/result.json
@@ -180,6 +180,10 @@
       {
         "auto_collapse": false,
         "body": [
+          {
+            "ioc": "Booking.com",
+            "ioc_type": "domain"
+          },
           {
             "ioc": "www.protware.com",
             "ioc_type": "domain"
@@ -211,6 +215,7 @@
           "network": {
             "static": {
               "domain": [
+                "Booking.com",
                 "www.protware.com"
               ],
               "uri": [
@@ -299,6 +304,11 @@
         }
       ],
       "network.static.domain": [
+        {
+          "heur_id": 2,
+          "signatures": [],
+          "value": "Booking.com"
+        },
         {
           "heur_id": 2,
           "signatures": [],

diff --git a/tests/results/31ac6f96008abcaced7e98108d26c8f9460e8a33283fe303d35e01d67c8a0bf2/result.json b/tests/results/31ac6f96008abcaced7e98108d26c8f9460e8a33283fe303d35e01d67c8a0bf2/result.json
@@ -243,10 +243,6 @@
             "ioc": "http://go.microsoft.com/fwlink/?LinkID=71543",
             "ioc_type": "uri"
           },
-          {
-            "ioc": "http://go.microsoft.com/fwlink/?LinkID=71543.",
-            "ioc_type": "uri"
-          },
           {
             "ioc": "http://msdn.microsoft.com/mshelp",
             "ioc_type": "uri"
@@ -267,10 +263,6 @@
             "ioc": "/fwlink/?LinkID=71543",
             "ioc_type": "uri_path"
           },
-          {
-            "ioc": "/fwlink/?LinkID=71543.",
-            "ioc_type": "uri_path"
-          },
           {
             "ioc": "/mshelp",
             "ioc_type": "uri_path"
@@ -305,15 +297,13 @@
                 "http://ddue.schemas.microsoft.com/authoring/2003/5",
                 "http://go.microsoft.com/fwlink/?LinkID=117437",
                 "http://go.microsoft.com/fwlink/?LinkID=71543",
-                "http://go.microsoft.com/fwlink/?LinkID=71543.",
                 "http://msdn.microsoft.com/mshelp",
                 "http://www.microsoft.com/tooltip"
               ],
               "uri_path": [
                 "/authoring/2003/5",
                 "/fwlink/?LinkID=117437",
                 "/fwlink/?LinkID=71543",
-                "/fwlink/?LinkID=71543.",
                 "/mshelp",
                 "/tooltip"
               ]
@@ -425,11 +415,6 @@
           "signatures": [],
           "value": "http://go.microsoft.com/fwlink/?LinkID=71543"
         },
-        {
-          "heur_id": 2,
-          "signatures": [],
-          "value": "http://go.microsoft.com/fwlink/?LinkID=71543."
-        },
         {
           "heur_id": 2,
           "signatures": [],
@@ -457,11 +442,6 @@
           "signatures": [],
           "value": "/fwlink/?LinkID=71543"
         },
-        {
-          "heur_id": 2,
-          "signatures": [],
-          "value": "/fwlink/?LinkID=71543."
-        },
         {
           "heur_id": 2,
           "signatures": [],

diff --git a/tests/results/85ec3b750424e1f63ec881010106efa480f15f29b794a7a6c70daaa9098da8e1/result.json b/tests/results/85ec3b750424e1f63ec881010106efa480f15f29b794a7a6c70daaa9098da8e1/result.json
@@ -1,7 +1,7 @@
 {
   "extra": {
     "drop_file": false,
-    "score": 24,
+    "score": 25,
     "sections": [
       {
         "auto_collapse": false,
@@ -207,6 +207,44 @@
         "title_text": "URLs",
         "zeroize_on_tag_safe": false
       },
+      {
+        "auto_collapse": false,
+        "body": [
+          {
+            "ioc": "https://bsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsf",
+            "ioc_type": "uri"
+          }
+        ],
+        "body_config": {
+          "column_order": [
+            "ioc_type",
+            "ioc"
+          ]
+        },
+        "body_format": "TABLE",
+        "classification": "TLP:C",
+        "depth": 0,
+        "heuristic": {
+          "attack_ids": [],
+          "frequency": 1,
+          "heur_id": 2,
+          "score": 1,
+          "score_map": {},
+          "signatures": {}
+        },
+        "promote_to": null,
+        "tags": {
+          "file": {
+            "string": {
+              "extracted": [
+                "https://bsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsf"
+              ]
+            }
+          }
+        },
+        "title_text": "MalwareJail extracted the following IOCs",
+        "zeroize_on_tag_safe": false
+      },
       {
         "auto_collapse": false,
         "body": [
@@ -279,6 +317,11 @@
         "heur_id": 2,
         "signatures": []
       },
+      {
+        "attack_ids": [],
+        "heur_id": 2,
+        "signatures": []
+      },
       {
         "attack_ids": [],
         "heur_id": 3,
@@ -295,6 +338,13 @@
       }
     ],
     "tags": {
+      "file.string.extracted": [
+        {
+          "heur_id": 2,
+          "signatures": [],
+          "value": "https://bsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsfjrbsf"
+        }
+      ],
       "network.dynamic.domain": [
         {
           "heur_id": null,

diff --git a/tests/results/f9e764b07015f388de096a1b240b7d7e96ce615abf32c63f7afc848a1822ae2a/result.json b/tests/results/f9e764b07015f388de096a1b240b7d7e96ce615abf32c63f7afc848a1822ae2a/result.json
@@ -326,11 +326,11 @@
             "ioc_type": "uri"
           },
           {
-            "ioc": "https://mail1.ccistack.com/fmlurlsvc/?fewReq=:B:JVc9NjIyPSFxOjUpNyFuYzo3Nj03NiF0bmBpZnNydWI6MWYyZDNiMzJmP2RmNmZlMjQ+MmJjZmRhMTI1MzUwMGQyPmRhNjc0ZiFzOjYxNDI2PjE0MjYhdm5jOjY+V0tEUjBENzc+Mjc+KjY+V0tEUjBDNzc+Mjc+IXVkd3M6bGtmZnRxZmlzb2hodUdkZG5qZm5rKWRoaiFkOjY+IW9jazo3&url=https%3a%2f%2fseeklogo.com%2fimages%2fA%2fadobe-logo-5CC38E11AD-seeklogo.com.png&fmlBlkTk",
+            "ioc": "https://mail1.ccistack.com/fmlurlsvc/?fewReq=:B:JVc9NjIyPSFxOjUpNyFuYzo3Nj03NiF0bmBpZnNydWI6MWYyZDNiMzJmP2RmNmZlMjQ+MmJjZmRhMTI1MzUwMGQyPmRhNjc0ZiFzOjYxNDI2PjE0MjYhdm5jOjY+V0tEUjBENzc+Mjc+KjY+V0tEUjBDNzc+Mjc+IXVkd3M6bGtmZnRxZmlzb2hodUdkZG5qZm5rKWRoaiFkOjY+IW9jazo3&url=https%3A%2F%2Fseeklogo.com%2Fimages%2FA%2Fadobe-logo-5CC38E11AD-seeklogo.com.png&fmlBlkTk",
             "ioc_type": "uri"
           },
           {
-            "ioc": "https://mail1.ccistack.com/fmlurlsvc/?fewReq=:B:JVc9NjIyPSFxOjUpNyFuYzo3Nj03NiF0bmBpZnNydWI6YTc/YTBjPmIyNjJlMT41MT82MGM+MDExZGI/YzU/MDcwYTZmMzMyMyFzOjYxNDI2PjE0MjYhdm5jOjY+V0tEUjBENzc+Mjc+KjY+V0tEUjBDNzc+Mjc+IXVkd3M6bGtmZnRxZmlzb2hodUdkZG5qZm5rKWRoaiFkOjY+IW9jazo3&url=https%3a%2f%2fseeklogo.com%2fimages%2fA%2fAdobe_PDF-logo-D4883D5CD6-seeklogo.com.png&fmlBlkTk",
+            "ioc": "https://mail1.ccistack.com/fmlurlsvc/?fewReq=:B:JVc9NjIyPSFxOjUpNyFuYzo3Nj03NiF0bmBpZnNydWI6YTc/YTBjPmIyNjJlMT41MT82MGM+MDExZGI/YzU/MDcwYTZmMzMyMyFzOjYxNDI2PjE0MjYhdm5jOjY+V0tEUjBENzc+Mjc+KjY+V0tEUjBDNzc+Mjc+IXVkd3M6bGtmZnRxZmlzb2hodUdkZG5qZm5rKWRoaiFkOjY+IW9jazo3&url=https%3A%2F%2Fseeklogo.com%2Fimages%2FA%2FAdobe_PDF-logo-D4883D5CD6-seeklogo.com.png&fmlBlkTk",
             "ioc_type": "uri"
           },
           {
@@ -350,11 +350,11 @@
             "ioc_type": "uri_path"
           },
           {
-            "ioc": "/fmlurlsvc/?fewReq=:B:JVc9NjIyPSFxOjUpNyFuYzo3Nj03NiF0bmBpZnNydWI6MWYyZDNiMzJmP2RmNmZlMjQ+MmJjZmRhMTI1MzUwMGQyPmRhNjc0ZiFzOjYxNDI2PjE0MjYhdm5jOjY+V0tEUjBENzc+Mjc+KjY+V0tEUjBDNzc+Mjc+IXVkd3M6bGtmZnRxZmlzb2hodUdkZG5qZm5rKWRoaiFkOjY+IW9jazo3&url=https%3a%2f%2fseeklogo.com%2fimages%2fA%2fadobe-logo-5CC38E11AD-seeklogo.com.png&fmlBlkTk",
+            "ioc": "/fmlurlsvc/?fewReq=:B:JVc9NjIyPSFxOjUpNyFuYzo3Nj03NiF0bmBpZnNydWI6MWYyZDNiMzJmP2RmNmZlMjQ+MmJjZmRhMTI1MzUwMGQyPmRhNjc0ZiFzOjYxNDI2PjE0MjYhdm5jOjY+V0tEUjBENzc+Mjc+KjY+V0tEUjBDNzc+Mjc+IXVkd3M6bGtmZnRxZmlzb2hodUdkZG5qZm5rKWRoaiFkOjY+IW9jazo3&url=https%3A%2F%2Fseeklogo.com%2Fimages%2FA%2Fadobe-logo-5CC38E11AD-seeklogo.com.png&fmlBlkTk",
             "ioc_type": "uri_path"
           },
           {
-            "ioc": "/fmlurlsvc/?fewReq=:B:JVc9NjIyPSFxOjUpNyFuYzo3Nj03NiF0bmBpZnNydWI6YTc/YTBjPmIyNjJlMT41MT82MGM+MDExZGI/YzU/MDcwYTZmMzMyMyFzOjYxNDI2PjE0MjYhdm5jOjY+V0tEUjBENzc+Mjc+KjY+V0tEUjBDNzc+Mjc+IXVkd3M6bGtmZnRxZmlzb2hodUdkZG5qZm5rKWRoaiFkOjY+IW9jazo3&url=https%3a%2f%2fseeklogo.com%2fimages%2fA%2fAdobe_PDF-logo-D4883D5CD6-seeklogo.com.png&fmlBlkTk",
+            "ioc": "/fmlurlsvc/?fewReq=:B:JVc9NjIyPSFxOjUpNyFuYzo3Nj03NiF0bmBpZnNydWI6YTc/YTBjPmIyNjJlMT41MT82MGM+MDExZGI/YzU/MDcwYTZmMzMyMyFzOjYxNDI2PjE0MjYhdm5jOjY+V0tEUjBENzc+Mjc+KjY+V0tEUjBDNzc+Mjc+IXVkd3M6bGtmZnRxZmlzb2hodUdkZG5qZm5rKWRoaiFkOjY+IW9jazo3&url=https%3A%2F%2Fseeklogo.com%2Fimages%2FA%2FAdobe_PDF-logo-D4883D5CD6-seeklogo.com.png&fmlBlkTk",
             "ioc_type": "uri_path"
           },
           {
@@ -401,16 +401,16 @@
               "uri": [
                 "https://api.ipify.org?format=json",
                 "https://code.jquery.com/jquery-3.4.1.min.js",
-                "https://mail1.ccistack.com/fmlurlsvc/?fewReq=:B:JVc9NjIyPSFxOjUpNyFuYzo3Nj03NiF0bmBpZnNydWI6MWYyZDNiMzJmP2RmNmZlMjQ+MmJjZmRhMTI1MzUwMGQyPmRhNjc0ZiFzOjYxNDI2PjE0MjYhdm5jOjY+V0tEUjBENzc+Mjc+KjY+V0tEUjBDNzc+Mjc+IXVkd3M6bGtmZnRxZmlzb2hodUdkZG5qZm5rKWRoaiFkOjY+IW9jazo3&url=https%3a%2f%2fseeklogo.com%2fimages%2fA%2fadobe-logo-5CC38E11AD-seeklogo.com.png&fmlBlkTk",
-                "https://mail1.ccistack.com/fmlurlsvc/?fewReq=:B:JVc9NjIyPSFxOjUpNyFuYzo3Nj03NiF0bmBpZnNydWI6YTc/YTBjPmIyNjJlMT41MT82MGM+MDExZGI/YzU/MDcwYTZmMzMyMyFzOjYxNDI2PjE0MjYhdm5jOjY+V0tEUjBENzc+Mjc+KjY+V0tEUjBDNzc+Mjc+IXVkd3M6bGtmZnRxZmlzb2hodUdkZG5qZm5rKWRoaiFkOjY+IW9jazo3&url=https%3a%2f%2fseeklogo.com%2fimages%2fA%2fAdobe_PDF-logo-D4883D5CD6-seeklogo.com.png&fmlBlkTk",
+                "https://mail1.ccistack.com/fmlurlsvc/?fewReq=:B:JVc9NjIyPSFxOjUpNyFuYzo3Nj03NiF0bmBpZnNydWI6MWYyZDNiMzJmP2RmNmZlMjQ+MmJjZmRhMTI1MzUwMGQyPmRhNjc0ZiFzOjYxNDI2PjE0MjYhdm5jOjY+V0tEUjBENzc+Mjc+KjY+V0tEUjBDNzc+Mjc+IXVkd3M6bGtmZnRxZmlzb2hodUdkZG5qZm5rKWRoaiFkOjY+IW9jazo3&url=https%3A%2F%2Fseeklogo.com%2Fimages%2FA%2Fadobe-logo-5CC38E11AD-seeklogo.com.png&fmlBlkTk",
+                "https://mail1.ccistack.com/fmlurlsvc/?fewReq=:B:JVc9NjIyPSFxOjUpNyFuYzo3Nj03NiF0bmBpZnNydWI6YTc/YTBjPmIyNjJlMT41MT82MGM+MDExZGI/YzU/MDcwYTZmMzMyMyFzOjYxNDI2PjE0MjYhdm5jOjY+V0tEUjBENzc+Mjc+KjY+V0tEUjBDNzc+Mjc+IXVkd3M6bGtmZnRxZmlzb2hodUdkZG5qZm5rKWRoaiFkOjY+IW9jazo3&url=https%3A%2F%2Fseeklogo.com%2Fimages%2FA%2FAdobe_PDF-logo-D4883D5CD6-seeklogo.com.png&fmlBlkTk",
                 "https://www.adobe.com/favicon.ico",
                 "https://www.moneyminerxyx.xyz/dude/post.php"
               ],
               "uri_path": [
                 "/dude/post.php",
                 "/favicon.ico",
-                "/fmlurlsvc/?fewReq=:B:JVc9NjIyPSFxOjUpNyFuYzo3Nj03NiF0bmBpZnNydWI6MWYyZDNiMzJmP2RmNmZlMjQ+MmJjZmRhMTI1MzUwMGQyPmRhNjc0ZiFzOjYxNDI2PjE0MjYhdm5jOjY+V0tEUjBENzc+Mjc+KjY+V0tEUjBDNzc+Mjc+IXVkd3M6bGtmZnRxZmlzb2hodUdkZG5qZm5rKWRoaiFkOjY+IW9jazo3&url=https%3a%2f%2fseeklogo.com%2fimages%2fA%2fadobe-logo-5CC38E11AD-seeklogo.com.png&fmlBlkTk",
-                "/fmlurlsvc/?fewReq=:B:JVc9NjIyPSFxOjUpNyFuYzo3Nj03NiF0bmBpZnNydWI6YTc/YTBjPmIyNjJlMT41MT82MGM+MDExZGI/YzU/MDcwYTZmMzMyMyFzOjYxNDI2PjE0MjYhdm5jOjY+V0tEUjBENzc+Mjc+KjY+V0tEUjBDNzc+Mjc+IXVkd3M6bGtmZnRxZmlzb2hodUdkZG5qZm5rKWRoaiFkOjY+IW9jazo3&url=https%3a%2f%2fseeklogo.com%2fimages%2fA%2fAdobe_PDF-logo-D4883D5CD6-seeklogo.com.png&fmlBlkTk",
+                "/fmlurlsvc/?fewReq=:B:JVc9NjIyPSFxOjUpNyFuYzo3Nj03NiF0bmBpZnNydWI6MWYyZDNiMzJmP2RmNmZlMjQ+MmJjZmRhMTI1MzUwMGQyPmRhNjc0ZiFzOjYxNDI2PjE0MjYhdm5jOjY+V0tEUjBENzc+Mjc+KjY+V0tEUjBDNzc+Mjc+IXVkd3M6bGtmZnRxZmlzb2hodUdkZG5qZm5rKWRoaiFkOjY+IW9jazo3&url=https%3A%2F%2Fseeklogo.com%2Fimages%2FA%2Fadobe-logo-5CC38E11AD-seeklogo.com.png&fmlBlkTk",
+                "/fmlurlsvc/?fewReq=:B:JVc9NjIyPSFxOjUpNyFuYzo3Nj03NiF0bmBpZnNydWI6YTc/YTBjPmIyNjJlMT41MT82MGM+MDExZGI/YzU/MDcwYTZmMzMyMyFzOjYxNDI2PjE0MjYhdm5jOjY+V0tEUjBENzc+Mjc+KjY+V0tEUjBDNzc+Mjc+IXVkd3M6bGtmZnRxZmlzb2hodUdkZG5qZm5rKWRoaiFkOjY+IW9jazo3&url=https%3A%2F%2Fseeklogo.com%2Fimages%2FA%2FAdobe_PDF-logo-D4883D5CD6-seeklogo.com.png&fmlBlkTk",
                 "/jquery-3.4.1.min.js",
                 "?format=json"
               ]
@@ -712,12 +712,12 @@
         {
           "heur_id": 2,
           "signatures": [],
-          "value": "https://mail1.ccistack.com/fmlurlsvc/?fewReq=:B:JVc9NjIyPSFxOjUpNyFuYzo3Nj03NiF0bmBpZnNydWI6MWYyZDNiMzJmP2RmNmZlMjQ+MmJjZmRhMTI1MzUwMGQyPmRhNjc0ZiFzOjYxNDI2PjE0MjYhdm5jOjY+V0tEUjBENzc+Mjc+KjY+V0tEUjBDNzc+Mjc+IXVkd3M6bGtmZnRxZmlzb2hodUdkZG5qZm5rKWRoaiFkOjY+IW9jazo3&url=https%3a%2f%2fseeklogo.com%2fimages%2fA%2fadobe-logo-5CC38E11AD-seeklogo.com.png&fmlBlkTk"
+          "value": "https://mail1.ccistack.com/fmlurlsvc/?fewReq=:B:JVc9NjIyPSFxOjUpNyFuYzo3Nj03NiF0bmBpZnNydWI6MWYyZDNiMzJmP2RmNmZlMjQ+MmJjZmRhMTI1MzUwMGQyPmRhNjc0ZiFzOjYxNDI2PjE0MjYhdm5jOjY+V0tEUjBENzc+Mjc+KjY+V0tEUjBDNzc+Mjc+IXVkd3M6bGtmZnRxZmlzb2hodUdkZG5qZm5rKWRoaiFkOjY+IW9jazo3&url=https%3A%2F%2Fseeklogo.com%2Fimages%2FA%2Fadobe-logo-5CC38E11AD-seeklogo.com.png&fmlBlkTk"
         },
         {
           "heur_id": 2,
           "signatures": [],
-          "value": "https://mail1.ccistack.com/fmlurlsvc/?fewReq=:B:JVc9NjIyPSFxOjUpNyFuYzo3Nj03NiF0bmBpZnNydWI6YTc/YTBjPmIyNjJlMT41MT82MGM+MDExZGI/YzU/MDcwYTZmMzMyMyFzOjYxNDI2PjE0MjYhdm5jOjY+V0tEUjBENzc+Mjc+KjY+V0tEUjBDNzc+Mjc+IXVkd3M6bGtmZnRxZmlzb2hodUdkZG5qZm5rKWRoaiFkOjY+IW9jazo3&url=https%3a%2f%2fseeklogo.com%2fimages%2fA%2fAdobe_PDF-logo-D4883D5CD6-seeklogo.com.png&fmlBlkTk"
+          "value": "https://mail1.ccistack.com/fmlurlsvc/?fewReq=:B:JVc9NjIyPSFxOjUpNyFuYzo3Nj03NiF0bmBpZnNydWI6YTc/YTBjPmIyNjJlMT41MT82MGM+MDExZGI/YzU/MDcwYTZmMzMyMyFzOjYxNDI2PjE0MjYhdm5jOjY+V0tEUjBENzc+Mjc+KjY+V0tEUjBDNzc+Mjc+IXVkd3M6bGtmZnRxZmlzb2hodUdkZG5qZm5rKWRoaiFkOjY+IW9jazo3&url=https%3A%2F%2Fseeklogo.com%2Fimages%2FA%2FAdobe_PDF-logo-D4883D5CD6-seeklogo.com.png&fmlBlkTk"
         },
         {
           "heur_id": 2,
@@ -744,12 +744,12 @@
         {
           "heur_id": 2,
           "signatures": [],
-          "value": "/fmlurlsvc/?fewReq=:B:JVc9NjIyPSFxOjUpNyFuYzo3Nj03NiF0bmBpZnNydWI6MWYyZDNiMzJmP2RmNmZlMjQ+MmJjZmRhMTI1MzUwMGQyPmRhNjc0ZiFzOjYxNDI2PjE0MjYhdm5jOjY+V0tEUjBENzc+Mjc+KjY+V0tEUjBDNzc+Mjc+IXVkd3M6bGtmZnRxZmlzb2hodUdkZG5qZm5rKWRoaiFkOjY+IW9jazo3&url=https%3a%2f%2fseeklogo.com%2fimages%2fA%2fadobe-logo-5CC38E11AD-seeklogo.com.png&fmlBlkTk"
+          "value": "/fmlurlsvc/?fewReq=:B:JVc9NjIyPSFxOjUpNyFuYzo3Nj03NiF0bmBpZnNydWI6MWYyZDNiMzJmP2RmNmZlMjQ+MmJjZmRhMTI1MzUwMGQyPmRhNjc0ZiFzOjYxNDI2PjE0MjYhdm5jOjY+V0tEUjBENzc+Mjc+KjY+V0tEUjBDNzc+Mjc+IXVkd3M6bGtmZnRxZmlzb2hodUdkZG5qZm5rKWRoaiFkOjY+IW9jazo3&url=https%3A%2F%2Fseeklogo.com%2Fimages%2FA%2Fadobe-logo-5CC38E11AD-seeklogo.com.png&fmlBlkTk"
         },
         {
           "heur_id": 2,
           "signatures": [],
-          "value": "/fmlurlsvc/?fewReq=:B:JVc9NjIyPSFxOjUpNyFuYzo3Nj03NiF0bmBpZnNydWI6YTc/YTBjPmIyNjJlMT41MT82MGM+MDExZGI/YzU/MDcwYTZmMzMyMyFzOjYxNDI2PjE0MjYhdm5jOjY+V0tEUjBENzc+Mjc+KjY+V0tEUjBDNzc+Mjc+IXVkd3M6bGtmZnRxZmlzb2hodUdkZG5qZm5rKWRoaiFkOjY+IW9jazo3&url=https%3a%2f%2fseeklogo.com%2fimages%2fA%2fAdobe_PDF-logo-D4883D5CD6-seeklogo.com.png&fmlBlkTk"
+          "value": "/fmlurlsvc/?fewReq=:B:JVc9NjIyPSFxOjUpNyFuYzo3Nj03NiF0bmBpZnNydWI6YTc/YTBjPmIyNjJlMT41MT82MGM+MDExZGI/YzU/MDcwYTZmMzMyMyFzOjYxNDI2PjE0MjYhdm5jOjY+V0tEUjBENzc+Mjc+KjY+V0tEUjBDNzc+Mjc+IXVkd3M6bGtmZnRxZmlzb2hodUdkZG5qZm5rKWRoaiFkOjY+IW9jazo3&url=https%3A%2F%2Fseeklogo.com%2Fimages%2FA%2FAdobe_PDF-logo-D4883D5CD6-seeklogo.com.png&fmlBlkTk"
         },
         {
           "heur_id": 2,